Most Organizations Still Lack Adequate Identity Management Controls
An overwhelming number of organizations appear to lack mature best practices when it comes to addressing identity and access management to their systems, making them more vulnerable to breaches, according to 203 IT decision makers surveyed by Forrester Consulting.
Results of the survey, commissioned by IAM provider Centrify, were shared this week at the RSA Conference in San Francisco. Centrify CEO Tom Kemp shared the findings Monday during the Cloud Security Alliance event. A report based on the survey's findings determined that the least mature organizations experienced twice the number of breaches as the most mature ones.
That's not to say those who have adequately addressed authentication are immune to breaches -- they reported 5.7 annual incidents, while those with lacking identity and access management policies reported an average of 12.5 incidents per year. Across the board, two thirds said they have experienced five or more breaches during the past two years, with misuse of identities and passwords the key causes.
Nevertheless, most IT and information security managers aren't ignoring authentication and identity management, Corey Williams, senior director of product management at Centrify, acknowledged. "It's a more piecemeal approach. They do a few tactical things but not looking at things holistically," Williams said. The Forrester report emphasized issues stemming from privileged access as a common cause of breaches.
During the RSA Conference, Centrify polled another 100 security managers, which found 68 percent enforce single sign-on and 43 percent have multi-factor authentication implemented in their organization. Only 36 percent responded that they don't allow sharing of their privileged accounts, with 13 percent not allowing session recording, 12 percent implementing granular deprovisioning of access across server and application accounts and only 8 percent having privilege elevation management.
Posted by Jeffrey Schwartz on 02/17/2017 at 12:02 PM